6

I always thought that the reason we couldn't use it was because it required too many CPU cycle. But an answer from @TomLeek indicated that this was not the case :

https://security.stackexchange.com/a/103446/50051

Most texts that talk about hybrid encryption say that we need to do that because asymmetric encryption is slow, but that's wrong. The real reason why hybrid encryption is used is because known asymmetric encryption algorithms cannot simply process messages of arbitrary length, and we have no real idea about how we could alter them in order to do so securely. Basically, the "chaining modes" for block ciphers do not have equivalents for asymmetric encryption that would be obviously safe.

Why is it so complicated to use RSA as a block cipher?

When you look at it quickly, RSA encrypt a block of text so we could call it a "block cipher" and then you just need to plug that into a good block cipher mode of operation and you would call it a day. BUT, it seems that RSA require some fancy padding to be secure. Would the security problem related to that padding issue?

https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Padding

Improve this question
4
  • 3
    Related: crypto.stackexchange.com/questions/14/…
    – StackzOfZtuff
    Commented Oct 29, 2015 at 20:18
  • Can you explain what part of Tom's answer you don't understand? Specifically he said it's hard to know how to properly chain the blocks together in a secure way. If you don't chain the blocks together using feedback from one to put into the next, you get the problems of ECB mode in block ciphers.
    – Steve Sether
    Commented Oct 29, 2015 at 21:18
  • @SteveSether I understand that part quite well but everything is in the details. Why can't you use the feedback from one block for the next one like in CBC. The answer of ThomasPornin on crypto SE give more clues to the reason.
    – Gudradain
    Commented Oct 30, 2015 at 1:51
  • Thank you for the question. There seems to be a religion on symmetric encryption with the dogma, that you cannot even call RSA a block cipher. Having looked up this topic in several search engines, I find that the analysis of your question seems to be absent, at most put aside with memorized statements. By intuition I don't buy that AES and ECC hype, as these will be the first ones eaten up by quantum computers; AES not even scalable and even the discussion on raising the dimensions for some AES+ is in the same manner politically incorrect.
    – Sam Ginrich
    Commented Jan 6, 2022 at 16:27

2 Answers 2

Reset to default
2

There is no theoretical reason why asymmetric algorithms can't be optimized to handle larger length plain text messages, but symmetric algorithms have a few advantages for application level data bound to their symmetric nature.

  • Having a single secret shared between two peers for user (application level) messaging is conducive to simple and elegant protocols.
  • Less cryptographic innovation is required to provide speed and resistance to partial plain text and other attacks because the burden of having a public key that does not open a door to the discovery of the private key in any reasonable time frame is relieved.
  • Symmetric algorithms and software implementations of them have evolved over the historical use of SSL and TLS along the lines of high speed, stream-able frame handling, and resilience to attack for large messages.
Improve this answer
1
  • 1
    What about the 'arbitrary length' reason mentioned by Tom Leek in the question? What about the padding issue brought up in the question?
    – schroeder ♦
    Commented Jan 24, 2017 at 11:39
0

Yes RSA can easily be used as a block cipher as you mentioned, but the real problem is speed. When you design a protocol you need it to work smoothly between all type of devices, you need to deliver a good quality of service to your clients, and what is better than block and stream ciphers to deliver good speed!

Google for example is is moving to CHACHA20 because it is faster than AES and uses CPU friendly instruction.

Improve this answer
5
  • Every part of this answer is the opposite of what was asked in the question. Is the question’s premise wrong?
    – Steve
    Commented Oct 8, 2018 at 15:23
  • Not much research is done on having RSA to work as block cipher with different mode of operations that insure security. Why? Because no body is going to use a slow block cipher.
    – daygoor
    Commented Oct 8, 2018 at 16:49
  • I thought it is a security factor, when decryption is comparably slow, so a brute force search will run out of time.
    – Sam Ginrich
    Commented Jan 6, 2022 at 16:15
  • @SamGinrich Well, if you converted the entire mass of earth to top-end CPUs, they could probably brute force an 128-bit AES or CHACHA20 key in about a second, give or take an order of magnitude (and more energy than used by the entirety of human civilization to date). If it was a 256-bit key, though, brute force would take roughly 10^20 (a trillion times a trillion times a hundred) times the age of the universe. Since I don't think anybody has a planet made of computronium handy anyhow, I'm not going to worry about the impact on brute-forcing time of using symmetric ciphers!
    – CBHacking
    Commented Feb 10, 2022 at 23:19
  • @CBHacking Where I was talking about RSA. When it comes to RSA the academic attitude already has a quantum computer at hand, which solves the factoriziation problem in seconds. Totally different with AES, where you need this "planet" of conventional computers. I'll observe this satire :)
    – Sam Ginrich
    Commented Feb 11, 2022 at 9:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .